{"id":"CVE-2025-54800","summary":"Hydra persistent XSS in build metrics","details":"Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.","aliases":["GHSA-7qwg-q53v-vh99"],"modified":"2026-04-02T12:53:59.335959Z","published":"2025-08-12T15:47:11.337Z","database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54800.json","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54800.json"},{"type":"ADVISORY","url":"https://github.com/NixOS/hydra/security/advisories/GHSA-7qwg-q53v-vh99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54800"},{"type":"FIX","url":"https://github.com/NixOS/hydra/commit/dea1e168f590efb27db32dbacc82b09e15f8ae4b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nixos/hydra","events":[{"introduced":"0"},{"fixed":"dea1e168f590efb27db32dbacc82b09e15f8ae4b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54800.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"2025-08-12"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}